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(57) Abstract: The invention proposes 
a method to provide privacy for users or 
a user from a group of users with respect 
to authorizations they are granted, where 
such authorizations are expressed using 
digital authorization certificates, and with 
respect to domain certificates in case of 
groups of users. The idea is to conceal the 
user identity in the certificates, while the 
certificate itself remains in the clear. In 
this way, certificates can be widely and 
openly available, e.g. in a public network, 
without a random observer being able to 
link a user to an authorization or to identify 
a user within a domain. Privacy is also 
provided towards the certificate verifier by 
means of zero-knowledge protocols, which 
are carried out between the user and the 
verifier in order for the verifier to check a 
user's entitlement to a certificate. Privacy 
is further provided towards the certificate 
issuer as well, by means of a mechanism 
that allows the anonymous (buying or) 
issuing of certificates from the issuer. 
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